CVE-2026-46363 is a stored cross-site scripting vulnerability affecting phpMyFAQ before version 4.1.2. The flaw exists in the FAQ creation and update endpoints, where input sanitization can be bypassed by encode-decode cycles, allowing authenticated users with FAQ_ADD permission to inject malicious script tags via the question or answer parameters. These scripts execute in every visitor's browser when the FAQ content is rendered with the raw Twig filter, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with no availability impact. No patch or official remediation guidance has been published as of the data provided.

The vulnerability allows authenticated users with FAQ_ADD permission to inject persistent malicious scripts that execute in the browsers of all visitors viewing the affected FAQ content. This can lead to partial confidentiality and integrity compromise, such as theft of session tokens or manipulation of displayed content. There is no direct impact on system availability. Exploitation requires authentication and user interaction (visiting the malicious FAQ page). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict FAQ_ADD permissions to trusted users only and avoid rendering FAQ content using the raw Twig filter. Monitor vendor channels for updates and apply patches promptly once released.